is an indicator that an attack has already succeeded. Surface reduction One approach to improving information security is to reduce the attack surface of a system or software. The basic strategies of attack surface reduction include the following: reduce the amount of code running, reduce entry points available to untrusted users, and eliminate services requested by relatively few users. By having less code available to unauthorized actors, there tend to be fewer failures. By turning off unnecessary functionality, there are fewer security risks. Although attack surface reduction helps prevent security failures, it does not mitigate the amount of damage an attacker could inflict once a vulnerability is found. See also Vulnerability (computing) Computer security Attack Surface Analyzer Vulnerability management Vulnerability scanner References Computer security software Mobile security